Overview
Every new resident payment passes three checks before it reaches the payment gateway: velocity limits, a duplicate check, and a risk score. A scheduled retry re-presents the same payment and does not run them again, and a payment a staff member records by hand skips them. Failed payments follow a fixed retry schedule that depends on why they failed. Money going out to vendors is guarded by different controls, summarized at the end of this article.
Velocity Limits
The limits count the payments of the unit's owner that are pending, processing, or succeeded.
| Limit | Value |
|---|---|
| One payment | $5,000 |
| Payments in one minute | 2 |
| Payments in one hour | 5 |
| Payments in 24 hours | 10 |
| Amount in 24 hours | $10,000 |
A payment over a limit is marked failed with the reason recorded on the payment, and the failure notice goes out as it does for any failed payment.
Duplicate Payments
A payment for the same unit, month, year, and amount as another payment created in the last five minutes is refused as a duplicate. The refusal names the earlier payment.
Risk Score
Each payment receives a score from 0 to 100, added up from five factors:
| Factor | Points |
|---|---|
| Amount over $2,000 | 20 |
| Three or more different units paid by the same owner within an hour | 15 |
| Account created less than 30 days ago | 10 |
| Payment for a period more than two months ahead | 15 |
| Payment between 02:00 and 05:59 UTC | 10 |
A score of 50 or more flags the payment. The payment alert addresses receive an email, the payment proceeds, and a second alert is sent if the payment succeeds. The score and the reasons behind it are stored on the payment record.
What Is Skipped
An invoice that staff generated by hand skips the velocity, duplicate, and score checks. It still passes the payment-state check and the row lock, so two submissions of the same invoice cannot both charge.
Failed Payments and Retries
Each retry is timed from the moment the failure was recorded. The schedule depends on the failure.
| Failure | Retries | After the last retry (logged) |
|---|---|---|
| Insufficient funds | 2: 48 hours after the failure, then 120 hours after the second failure | Logged for manual intervention |
| Card declined | 3: 1 hour, 24 hours, 72 hours | Logged as needing a new payment method |
| Processing error | 3: 15 minutes, 1 hour, 6 hours | Logged for manual intervention |
| Network error | 3: 2 minutes, 8 minutes, 30 minutes | Logged for manual intervention |
| Expired card | 1: 24 hours | Logged as needing a new payment method |
| Closed, invalid, or unauthorized account | None | Logged as needing a new payment method |
| Unrecognized failure | None; retried by hand only | Logged for manual intervention |
Two retries is the most the ACH rules allow for a return for insufficient funds, and the resident is notified of each. A closed or unauthorized account is never debited again. Nothing else fires after the last retry. The failure notice went out when the failure was first recorded, and the payment rests at failed; the resident's dashboard offers a retry for a failed payment.
Money Going Out
A vendor payment is not scored. It is governed by the bill's approval, which binds the amount, the vendor, and the fund, and on the transfer rail the bank, and which a payment spends once. Around that approval:
- Paying a vendor by transfer, changing a vendor's bank, and changing who holds authority each require a fresh authenticator code within the last ten minutes.
- A changed vendor bank waits three business days before it is paid. A different board member can end the wait early after calling the vendor at a number the association already had, with a fresh code and the association's bank PIN.
- Changing the payout bank takes two board members, and the first payout to the new bank is held until a person releases it.
- No single vendor payment, and no 24 hours of them in total, may exceed the association's transfer limit: its buffer target, or $5,000 where none is set. Changing the target takes a fresh code.
- Every vendor payment sent by transfer and every top-up is emailed to the whole board.
- A bounced payout reverses its entry and reopens the bill.
- The pinned payout bank is checked hourly against the processor, and automatic payouts pause when they disagree.
These controls are described in Disbursement Authorization Controls and Security & Trust.
How CommunityPay Enforces This
- Every new resident payment is checked against velocity limits — 2 a minute, 5 an hour, 10 a day, $5,000 a payment, $10,000 in 24 hours — before it reaches the gateway
- A payment for the same unit, period, and amount within five minutes is refused as a duplicate
- A risk score of 50 or more flags the payment and emails the payment alert addresses; the score and its reasons are stored on the payment
- Failed ACH payments retry on a fixed schedule by failure type; closed, invalid, and unauthorized accounts are never retried